npm - @mrhenry/prettier-twig - Versions diffs - 0.1.5 → 0.1.6 - Mend

@mrhenry/prettier-twig 0.1.5 → 0.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/CHANGELOG.md +6 -0
package/package.json +2 -2
package/src/index.js +25 -0
package/src/printer.js +38 -8
package/test/prettier-twig.test.js +45 -0

package/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,11 @@
 # Changelog
+## 0.1.6 (2026-09-26)
+ * Fixed an exponential-time denial of service when formatting nested twig blocks. The printer now declares `getVisitorKeys`, so Prettier's traversal visits a `twigBlock` body once instead of twice per level (a 25-level template previously took over a minute to format).
+ * Depth-capped the mapping/sequence structure formatter, so a deeply nested expression (`[[[ … ]]]`) is emitted verbatim instead of overflowing the call stack.
+ * Keep trailing comments inside twig block bodies on the line they follow, along with the inline content on that line
 ## 0.1.5 (2026-09-25)
  * Preserve the `<html>` tag's line layout: keep it on a single line when the source did (even with several attributes), and format it multi-line when the source split it

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
 	"name": "@mrhenry/prettier-twig",
-	"version": "0.1.5",
+	"version": "0.1.6",
 	"type": "module",
 	"main": "src/index.js",
 	"license": "MIT",
@@ -11,7 +11,7 @@
 		"test": "node --test test/*.test.js"
 	},
 	"dependencies": {
-		"@mrhenry/twig-html-parser": "^0.1.1"
+		"@mrhenry/twig-html-parser": "^0.1.2"
 	},
 	"peerDependencies": {
 		"prettier": "^3.0.0"

package/src/index.js CHANGED Viewed

@@ -34,6 +34,30 @@ function canAttachComment() {
 	return false;
 }
+/**
+ * The child-bearing keys of an AST node.
+ *
+ * Declaring this is a security requirement, not an optimisation: without it
+ * Prettier's default visitor walks *every* object-valued key, and a `twigBlock`
+ * exposes its body both as `children` and again as `sections[].body`. That
+ * double edge makes traversal work grow as `2^depth`, so a tiny nested
+ * template can hang the formatter. Only `children` and `attrs` are traversed
+ * (the printer reaches them through `path.call`); `sections` is internal.
+ *
+ * @param {any} node
+ * @returns {string[]} The keys whose values are child nodes.
+ */
+function getVisitorKeys(node) {
+	const keys = [];
+	if (Array.isArray(node.children)) {
+		keys.push('children');
+	}
+	if (Array.isArray(node.attrs)) {
+		keys.push('attrs');
+	}
+	return keys;
+}
 export const languages = [
 	{
 		name: 'twig',
@@ -62,6 +86,7 @@ export const printers = {
 		print,
 		embed,
 		canAttachComment,
+		getVisitorKeys,
 	},
 };

package/src/printer.js CHANGED Viewed

@@ -400,17 +400,29 @@ function isMultilineContainer(text) {
 	return new RegExp(`^\\${text[0]}[\\t ]*\\r?\\n`).test(text);
 }
+/**
+ * The deepest mapping/sequence nesting {@link formatStructures} descends into.
+ * Beyond this the original text is emitted verbatim, so an expression built
+ * from deeply nested `[[[ … ]]]` or `{a:{a:{…}}}` cannot drive the formatter's
+ * mutual recursion into a stack overflow.
+ */
+const MAX_STRUCTURE_DEPTH = 200;
 /**
  * Collects, in pre-order, whether each `{ … }` / `[ … ]` container of `text`
  * was multi-line in the source. They are consumed in the same order while
  * formatting.
  *
  * @param {string} text
+ * @param {number} [depth]
  * @returns {boolean[]}
  */
-function collectMultilineStructures(text) {
+function collectMultilineStructures(text, depth = 0) {
 	/** @type {boolean[]} */
 	const result = [];
+	if (depth > MAX_STRUCTURE_DEPTH) {
+		return result;
+	}
 	let quote = '';
 	let i = 0;
 	while (i < text.length) {
@@ -435,7 +447,7 @@ function collectMultilineStructures(text) {
 			const close = findMatchingBrace(text, i);
 			if (close !== -1) {
 				result.push(isMultilineContainer(text.slice(i, close + 1)));
-				result.push(...collectMultilineStructures(text.slice(i + 1, close)));
+				result.push(...collectMultilineStructures(text.slice(i + 1, close), depth + 1));
 				i = close + 1;
 				continue;
 			}
@@ -455,9 +467,13 @@ function collectMultilineStructures(text) {
  * @param {boolean} forceBreak Whether every container must expand.
  * @param {boolean[]} [multiline] Queue of source multi-line flags, in order.
  * @param {boolean} [trailingComma] Whether expanded containers get a trailing comma.
+ * @param {number} [depth] The current structure nesting depth.
  * @returns {any} A Prettier doc.
  */
-function formatStructures(text, forceBreak, multiline = [], trailingComma = true) {
+function formatStructures(text, forceBreak, multiline = [], trailingComma = true, depth = 0) {
+	if (depth > MAX_STRUCTURE_DEPTH) {
+		return text;
+	}
 	/** @type {any[]} */
 	const docs = [];
 	let quote = '';
@@ -489,7 +505,7 @@ function formatStructures(text, forceBreak, multiline = [], trailingComma = true
 				}
 				const sourceMultiline = multiline.shift() ?? false;
 				docs.push(
-					formatContainer(text.slice(i, close + 1), forceBreak || sourceMultiline, multiline, trailingComma),
+					formatContainer(text.slice(i, close + 1), forceBreak || sourceMultiline, multiline, trailingComma, depth + 1),
 				);
 				i = close + 1;
 				start = i;
@@ -546,9 +562,10 @@ function normalizeMappingEntry(entry) {
  * @param {boolean} forceBreak Whether the container must expand.
  * @param {boolean[]} [multiline] Queue of source multi-line flags, in order.
  * @param {boolean} [trailingComma] Whether an expanded container gets a trailing comma.
+ * @param {number} [depth] The current structure nesting depth.
  * @returns {any} A Prettier doc.
  */
-function formatContainer(text, forceBreak, multiline = [], trailingComma = true) {
+function formatContainer(text, forceBreak, multiline = [], trailingComma = true, depth = 0) {
 	const open = text[0];
 	const close = open === '{' ? '}' : ']';
 	const entries = splitTopLevel(text.slice(1, -1));
@@ -556,7 +573,7 @@ function formatContainer(text, forceBreak, multiline = [], trailingComma = true)
 		return `${open}${close}`;
 	}
 	const parts = entries.map((entry) =>
-		formatStructures(open === '{' ? normalizeMappingEntry(entry) : entry, false, multiline, trailingComma),
+		formatStructures(open === '{' ? normalizeMappingEntry(entry) : entry, false, multiline, trailingComma, depth),
 	);
 	const trailing = trailingComma ? ifBreak(',') : '';
 	// mappings get inner spaces (`{ a: 1 }`), sequences do not (`[1, 2]`)
@@ -916,12 +933,14 @@ function printTwigBlock(path, printCallback, source, options) {
 	// blank-line detection measures the source between the end of the previous
 	// non-whitespace item (or the opening / section head) and the current one
 	let previousEnd = node.open.atom.rawEnd;
+	let previousWasInline = false;
 	for (const section of node.sections ?? []) {
 		if (section.head) {
 			// mid tags (`{% else %}`, `{% elseif %}`) sit at the block's own indent
 			const head = formatTwigHead(section.head.atom.raw, options);
 			docs.push(hasBlankLine(source, previousEnd, section.head.atom.rawStart) ? [hardline, hardline, head] : [hardline, head]);
 			previousEnd = section.head.atom.rawEnd;
+			previousWasInline = false;
 		}
 		/** @type {any[]} */
 		const bodyDocs = [];
@@ -931,10 +950,21 @@ function printTwigBlock(path, printCallback, source, options) {
 			if (isWhitespaceOnly(child)) {
 				continue;
 			}
-			const childDoc = path.call(printCallback, 'children', i);
 			const { start, end } = contentBounds(child);
-			bodyDocs.push(hasBlankLine(source, previousEnd, start) ? [hardline, hardline, childDoc] : [hardline, childDoc]);
+			const gap = source.slice(previousEnd, start);
+			const childDoc = path.call(printCallback, 'children', i);
+			const inline = isInlineChild(child);
+			if (hasBlankLine(source, previousEnd, start)) {
+				bodyDocs.push([hardline, hardline, childDoc]);
+			} else if (!gap.includes('\n') && previousWasInline && inline) {
+				// consecutive inline content on one source line stays together,
+				// so a trailing comment remains after the line it comments
+				bodyDocs.push([gap === '' ? '' : ' ', childDoc]);
+			} else {
+				bodyDocs.push([hardline, childDoc]);
+			}
 			previousEnd = end;
+			previousWasInline = inline;
 		}
 		if (bodyDocs.length > 0) {
 			docs.push(indent(bodyDocs));

package/test/prettier-twig.test.js CHANGED Viewed

@@ -1283,6 +1283,29 @@ test('keeps inline comments next to content without adding line breaks', async (
 	}
 });
+test('keeps trailing comments inside twig block bodies on their line', async () => {
+	const source = `{% set animation_keyframes %}
+	0% { z-index: 1; } {# Start at bottom #}
+	1% { z-index: 999; } {# Come to front #}
+	{{ relative_item_duration }}% { z-index: 999; } {# Stay at front #}
+	{{ relative_item_duration + 1 }}% { z-index: 1; } {# Return to bottom #}
+{% endset %}
+`;
+	assert.equal(await fmt(source), source);
+	// a subtle variation that does get formatted: spaces inside the expressions
+	assert.equal(
+		await fmt(`{% set animation_keyframes %}
+	0% { z-index: 1; } {# Start at bottom #}
+	1% { z-index: 999; } {# Come to front #}
+	{{  relative_item_duration  }}% { z-index: 999; } {# Stay at front #}
+	{{  relative_item_duration + 1  }}% { z-index: 1; } {# Return to bottom #}
+{% endset %}
+`),
+		source,
+	);
+});
 test('keeps a comment written after the opening tag on that line', async () => {
 	{
 		const source = `<html lang="en" class="no-js"> {# TODO: set lang correctly #}
@@ -2363,3 +2386,25 @@ test('multiple twig structures on a single line', async () => {
 	);
 });
+test( 'deeply nested twig blocks format without exponential traversal', async() => {
+	// Without `getVisitorKeys` the printer's default traversal walks a
+	// `twigBlock` body twice per level (via `children` and `sections[].body`),
+	// so this 40-level input would take exponential time. Completing at all is
+	// the assertion; a regression turns this into a multi-hour hang.
+	const depth = 40;
+	const source = `${ '{% if x %}'.repeat( depth ) }x${ '{% endif %}'.repeat( depth ) }`;
+	const out = await fmt( source );
+	assert.ok( out.includes( 'x' ) );
+} );
+test( 'deeply nested structures inside an expression do not overflow the stack', async() => {
+	const depth = 5000;
+	const source = `{{ ${ '['.repeat( depth ) }1${ ']'.repeat( depth ) } }}`;
+	// The structure formatter stops recursing past its depth cap and emits the
+	// original text verbatim rather than overflowing the call stack.
+	await assert.doesNotReject( fmt( source ) );
+} );